CVE-2026-5795
Eclipse Foundation Eclipse Jetty
HIGH 7.4
At a glance
- Source
- NVD
- EPSS
- EPSS 0.53 % · percentile 45 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- eclipse
- NVD status
- Modified
Description
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
Weaknesses (CWE)
- CWE-226 — Sensitive Information in Resource Not Removed Before Reuse
- CWE-287 — Improper Authentication
References
- https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436chttps://
- https://gitlab.eclipse.org/security/cve-assignment/-/issues/92
- https://access.redhat.com/security/cve/CVE-2026-5795
- https://bugzilla.redhat.com/show_bug.cgi?id=2456519
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5795.json
- https://access.redhat.com/errata/RHSA-2026:25089
- https://access.redhat.com/errata/RHSA-2026:28573
- https://access.redhat.com/errata/RHSA-2026:17668
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | eclipse |
| CVSS 3.1 | HIGH 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | redhat-SADP |
| CVSS 3.1 | HIGH 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | NVD · emo@eclipse.org (Secondary) |
| CVSS 3.1 | HIGH 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary) |
Advisories
- GHSA-r7p8-xq5m-436c — Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
European references
- ENISA EUVD · EUVD-2026-20473
- GCVE · GCVE-0-2026-5795
CERT-FR advisories
- CERTFR-2026-AVI-1336 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0958 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0901 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0810 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0667 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*≥ 9.4.0 ≤ 9.4.58cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*≥ 10.0.0 ≤ 10.0.26cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*≥ 11.0.0 ≤ 11.0.26cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*≥ 12.0.0 < 12.0.34cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*≥ 12.1.0 < 12.1.8
Affected products
| Product | Versions |
|---|---|
| Eclipse Foundation · Eclipse Jetty | affected 12.1.0 ≤ 12.1.7 ; affected 12.0.0 ≤ 12.0.33 ; affected 11.0.0 ≤ 11.0.28 ; affected 10.0.0 ≤ 10.0.28 ; affected 9.4.0 ≤ 9.4.60 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |